Motivation The power of P2P - net.in.tum.de · PDF fileläuft, den NSN Anfang 2008...
8
Chair for Network Architectures and Services Department of Informatics TU München – Prof. Carle Peer-to-Peer Systems and Security IN2194 Prof. Dr.-Ing Georg Carle Dipl.-Inform. Heiko Niedermayer Peer-to-Peer Systems and Security, SS 2009 2 Organisatorisches Schein 60 % der Übungsaufgaben sinnvoll bearbeitet und mind. 1x gute Lösung vorgerechnet Sinnvoll = Versuch ersichtlich, eine richtige Lösung zu finden. Universitäre Selbstverantwortung: relevant für die Note ist die Prüfung. Prüfung am Ende mündlich bei Prof. Carle Einzig relevant für die Note. Übungsbetrieb 5 Übungen und Übungsblätter Raum 03.07.023 Übungstermin Donnerstags 10-12 Uhr 5 ECTS Zusatzaufgaben (auch praktisch) Anmeldung Über die Webseite des Lehrstuhls http://www.net.in.tum.de http://www.net.in.tum.de/de/lehre/ss09/vorlesungen/vorlesung-peer-to-peer-systeme-und-sicherheit/ Peer-to-Peer Systems and Security, SS 2009 3 Peer-to-Peer Systems and Security Motivation The power of P2P Peer-to-Peer Systems and Security, SS 2009 4 Peer-to-Peer Systems Network of equals (Peer: Ebenbürtiger / Gleichgestellter) Users can offer new services Users and their computers at the edges of the Internet share their resources (bandwidth, CPU, storage). Inherent scalability with growing Self-organization of the system No traffic management Autonomy from central entities like central servers Robustness Very popular due to file-sharing Responsible for majority of the traffic of the Internet!
Transcript of Motivation The power of P2P - net.in.tum.de · PDF fileläuft, den NSN Anfang 2008...
Chair for Network Architectures and ServicesDepartment of InformaticsTU München – Prof. Carle
Peer-to-Peer Systemsand Security
IN2194
Prof. Dr.-Ing Georg CarleDipl.-Inform. Heiko Niedermayer
Network Security, WS 2008/09, Chapter 9 2Peer-to-Peer Systems and Security, SS 2009 2
Organisatorisches
Schein60 % der Übungsaufgaben sinnvoll bearbeitet und mind. 1x gute Lösungvorgerechnet
Sinnvoll = Versuch ersichtlich, eine richtige Lösung zu finden.Universitäre Selbstverantwortung: relevant für die Note ist die Prüfung.
Prüfung am Ende mündlich bei Prof. CarleEinzig relevant für die Note.
Übungsbetrieb5 Übungen und ÜbungsblätterRaum 03.07.023Übungstermin
Donnerstags 10-12 Uhr5 ECTS Zusatzaufgaben (auch praktisch)
AnmeldungÜber die Webseite des Lehrstuhls http://www.net.in.tum.dehttp://www.net.in.tum.de/de/lehre/ss09/vorlesungen/vorlesung-peer-to-peer-systeme-und-sicherheit/
Network Security, WS 2008/09, Chapter 9 3Peer-to-Peer Systems and Security, SS 2009 3
Peer-to-Peer Systems and Security
Motivation
The power of P2P
Network Security, WS 2008/09, Chapter 9 4Peer-to-Peer Systems and Security, SS 2009 4
Peer-to-Peer Systems
Network of equals (Peer: Ebenbürtiger / Gleichgestellter)Users can offer new services
Users and their computers at the edges of the Internet share their resources (bandwidth, CPU, storage).
Inherent scalability with growing
Self-organization of the systemNo traffic management
Autonomy from central entities like central serversRobustness
Very popular due to file-sharing Responsible for majority of the traffic of the Internet!
Very popular due to file-sharing Responsible for majority of the traffic of the Internet!
Network Security, WS 2008/09, Chapter 9 5Peer-to-Peer Systems and Security, SS 2009 5
Authentication in GSM
NSS
BSC
GMSCIWF
OMC
MSC MSC
Abis
EIR
HLRVLR VLR
A
PDNISDN, PSTN
RSS
MS MS
BTS
BTS
BSC
Um
BSSradio cell
radio cell
MS
AUCOSS
Signaling
O
MS MS
BTS
BTS
BSC
Um
BSSradio cell
radio cell
MS
Involved in Authentication:MSBSS/MSC/VLRHLR/AUC
Network Security, WS 2008/09, Chapter 9 6Peer-to-Peer Systems and Security, SS 2009 6
GSM
Authentication center Base station controller Bas station systemBase transceiver stationInternational mobile subscriber identityHome location registerLocation area identifierMobile station (e.g. a mobile phone) Mobile switching centerMobile subscriber international ISDN numberTemporary mobile subscriber identityVisitor location register
AUCBSCBSSBTSIMSIHLRLAIMS
MSCMSISDN
TMSIVLR
Some GSM Abbreviations
Network Security, WS 2008/09, Chapter 9 7Peer-to-Peer Systems and Security, SS 2009 7
Press Reports
„Deutschlandweite Störungen im Handynetz von T-Mobile“, Christian Feld, WDR, April 21st 2009.
<http://www.heise.de/newsticker/T-Mobile-GAU-Gratis-SMS-als-Entschaedigung--/meldung/136581>T-Mobile hatte im vergangenen Jahr alte HLR-Systeme, die Verbindungen zwischen Mobilfunkstationen und Endgeräten steuern, durch eine neue Systemplattform von Nokia Siemens Networks (NSN) ersetzt, auf der Software des britischen Netzwerkspezialisten Apertioläuft, den NSN Anfang 2008 übernommen hatte. An dem neuen System seien nun Updates vorgenommen worden, erklärte Pölzl. Dabei sei es dann zu einem Softwareproblem gekommen. Die genauen Ursachen würden im Detail noch ergründet. Der Bundesnetzagentur muss das Unternehmen nun Auskunft über Ausmaß und Ursache der Panne erteilen.
“Der Ausfall eines Servers der Deutschen Telekom hat am Montagabend [29. Okt. 2007] und in der Nacht zu Dienstag stundenlang zu Ausfällen im Telefonnetz in ganz Deutschland geführt.” Press article, Financial Times, October 2007
“Skype Outage Continues For Some, Businesses Affected”, Press Article, PC World, August 17th 2007
“VoIP-Störung bei United Internet”, Press Article, heise newsticker, July 2006.
Network Security, WS 2008/09, Chapter 9 8Peer-to-Peer Systems and Security, SS 2009 8
Related Research Activities at the Chair I8
Goal:Improve the resilience/security of network services using the Peer-to-Peer networking paradigmtaking Voice over IP (VoIP) as an example
Network Security, WS 2008/09, Chapter 9 9Peer-to-Peer Systems and Security, SS 2009 9
Cooperative SIP (CoSIP)
User registration with CoSIP
REGISTER
put(H(SIP_URI), Contact_URI)
Alice
DHT
(1) SIP INVITE
(1') get(H(SIP_URI))
(2) Contact_URI
(3) CoSIP INVITE
Alice Bob
Session establishment withCoSIP
Network Security, WS 2008/09, Chapter 9 10Peer-to-Peer Systems and Security, SS 2009 10
Application of CoSIP in the fixed network
CoSIP adapter/ proxy in DSL routersCoSIP adapters organize themselves into a P2P network
DSL Routerwith a CoSIP adapter / CoSIP proxy
Small Officeand Home
Network(SOHO)
SIP InfrastructureInternet/VoIP Provider
SOHO
Network Security, WS 2008/09, Chapter 9 11Peer-to-Peer Systems and Security, SS 2009 11
Weitere ausgewählte Forschung am Lehrstuhl für
Netzarchitekturen und Netzdienste – I8
Network Security, WS 2008/09, Chapter 9 12Peer-to-Peer Systems and Security, SS 2009 12
Projektschwerpunkte
BWFIT AmbiSense
BWFIT SpoVNet
France-TelecomSASCO
NSN TC-NAC
NSN SelfMan
BMBF ScaleNet
DFG LUPUS
EU AutHoNe
EU ResumeNet
Netz-Sicherheit
P2P und Overlays
Instrumen-tierung
Mobilkom-munikation
Autonomic /Self-Org. Man.
Network Security, WS 2008/09, Chapter 9 13Peer-to-Peer Systems and Security, SS 2009 13
EU FP7-Projekt ResumeNet
“Resilience and Survivability for future networking: framework, mechanisms, and experimental evaluation”
Ein Projekt im Rahmen des FIRE-Programms(„Future Internet Research and Experimentation“)
Konsortium:
ETH Zürich Switzerland
Lancaster University United Kingdom
Technical University Munich Germany
France Telecom France
NEC Europe Ltd United Kingdom
Universität Passau Germany
Technical University Delft Netherlands
Uppsala Universitet Sweden
Université de Liège Belgium
Strategie: D2R2DR
EU ResumeNet Network Security, WS 2008/09, Chapter 9 14Peer-to-Peer Systems and Security, SS 2009 14
Robuste Diensterbringung (Service Resilience)
Kombination von P2P- und Client/Server-AnsatzHohe Ausfallsicherheit bei gleichzeitigem Schutz von P2P-VerwundbarkeitBeispiel-Anwendung CoSIP: Nebenläufige Signalisierung bei Voice over IP
EU ResumeNet
Network Security, WS 2008/09, Chapter 9 15Peer-to-Peer Systems and Security, SS 2009 15
Robuste Diensterbringung (2)
Ansätze:Hybrides P2P-Overlay-NetzwerkPeers mit verschiedenen Rollen, verifizierbarer Identität, Virtualisierung
Ziele:Kooperation zwischen End-Knoten und Infrastruktur für bestmögliche Zuverlässigkeit, Dienstgüte, Skalierbarkeit
EU ResumeNet Network Security, WS 2008/09, Chapter 9 16Peer-to-Peer Systems and Security, SS 2009 16
AutHoNe - Autonomic Home Networking
EUREKA-Celtic/BMBF-Projekt
Partner in DeutschlandTU MünchenFraunhofer FOKUS Siemens Corporate TechnologyHirschmann Automation and Control
EU/Celtic PartnerFrance Telecom, Frankreich
Sony-Ericsson, Schweden
Ginkgo Networks, Frankreich
Univ. Pierre et Marie Curie, Paris (UPMC-LIP6), Frankreich
Universität Lund, Schweden
EU AutHoNe
Network Security, WS 2008/09, Chapter 9 17Peer-to-Peer Systems and Security, SS 2009 17
Entwicklung einer Kommunikationsarchitektur fürSensoren und AktuatorenMultimediageräteComputer, PDAs, MobiltelefoneHome appliances
AutHoNe-Framework unterstütztEinfache BenutzerinteraktionSelf* - Eigenschaften
• Konfiguration• Schutz• Optimierung• Heilung
Sicherheitsmechanismen• Nutzerorientiert
Lokaler sowie entfernter Dienstzugriff
AutHoNe: Projektziele
EU AutHoNe Network Security, WS 2008/09, Chapter 9 18Peer-to-Peer Systems and Security, SS 2009 18
AutHoNe: Szenario
IdentitätsmanagementWissenssammlungBenutzerschnittstelle?2 Homes, Identifikation, Mobilität, Services
Other Networks
Knowledge Plane
Wireless Access Point 1
Our Site
Our Guests Site
Guest
Site Owner(not necessarily big knowledge in cs)Wireless Access Point 2
Our Site
Services
Policies
Exterior Gateway
EU AutHoNe
Network Security, WS 2008/09, Chapter 9 19Peer-to-Peer Systems and Security, SS 2009 19
Home BBobPDA
Addressing
EntityID is...hash over entity’s public key
Authone address...consists of entityIDs
• entityID.homeID.authoneis bounded to identitysupports inter-home addressing
Lookup serviceTranslates Authone address to IP addressProvided by special node(s) (e.g. home gateway)
BobPDAID = hash(pubkeyBobPDA)HomeBID = hash(pubkeyHomeB)
Authone address = BobPDAID.HomeBID.authone
IP address
Identity
EntityID
EU AutHoNe Network Security, WS 2008/09, Chapter 9 20Peer-to-Peer Systems and Security, SS 2009 20
France-Telecom-Projekt SASCO: Overlay Security
Projekt SASCOKooperation mit France Télécom und Fraunhofer FOKUS
Situated Overlay Nodes (SON)
Situated Overlay
Access ControlResource Client
DMZ Network Provider
HSS
Geographic &Geodetic
Information
FT SASCO
Network Security, WS 2008/09, Chapter 9 21Peer-to-Peer Systems and Security, SS 2009 21
SASCO: Situated Autonomic Service Control
ZielSelbstorganisierende Dienstplattform als Alternative zum 3GPP IMSIntegration von Peer-to-Peer-Technologien und Zugriffskontrolle
Ansatz
Negotiation of Service Parameters
Dynamic Access Control
FT SASCO Network Security, WS 2008/09, Chapter 9 22Peer-to-Peer Systems and Security, SS 2009 22
BWFIT SpoVNet: Cross-Layer-Information for Overlays
SpoVNet: Spontane Virtuelle NetzeFlexible, adaptive und spontane Bereitstellung von Diensten Ansatz über Overlays
Let-1000-networks-bloom anstelle von One-size-fits-allZugeschnittene Architekturen für Anwendungen und NetzeDienstgüte-Unterstützung durch Cross-Layer-Information und OptimierungKeine dedizierte Infrastruktur erforderlich
Prof. Dr. Kurt Rothermel
Universität Stuttgart
Prof. Dr. Martina ZitterbartUniversität Karlsruhe
Prof. Dr. Paul KühnUniversität Stuttgart
Prof. Dr. Georg CarleTU München
Prof. Dr. Wolfgang Effelsberg
Universität Mannheim
Anwendungen im Projekt:Video Streaming undRealzeitspiel
BWFIT SpoVNet
Network Security, WS 2008/09, Chapter 9 23Peer-to-Peer Systems and Security, SS 2009 23
BW-FIT SpoVNet: Cross-Layer-Information for Overlays
BeiträgeCLIO (Cross-Layer-Information for Overlays)
Informationsdienst für Anwendungen/DiensteMessungen
• Innovative Messverfahren• Overlay-übergreifender Dienst • Privacy-freundliche Datenhaltung
Anomalieerkennung auf Overlay-Daten
Sicherheit für SpoVNetBeteiligung am Entwurf der Sicherheitsarchitektur Sicherheitskomponente
D
A
B
C
“Latenz zu D?”
Remote-Aufträge für CLIOz.B. Netzbeitritt Autorisierung nur, wenn Peer gut genug an andere Knoten angebunden ist (nützlich für Realzeitspiel)
“Latenz zu D?”
BWFIT SpoVNet Network Security, WS 2008/09, Chapter 9 24Peer-to-Peer Systems and Security, SS 2009 24
Peer-to-Peer Systems and Security
The lecture…
Network Security, WS 2008/09, Chapter 9 25Peer-to-Peer Systems and Security, SS 2009 25
Course Overview
Chapter 1: Peer-to-Peer systemsand overlay networks
Chapter 2:Security in distributed
systems
Chapter 3:Anonymity and
Privacy
Peer-to-Peer
SecurityClient/ServerClassic networking
Network Security, WS 2008/09, Chapter 9 26Peer-to-Peer Systems and Security, SS 2009 26
Peer-to-Peer Systems
Network of equals (Peer: Ebenbürtiger / Gleichgestellter)No distinction between client and serverUsers and their computers at the edges of the Internet share their resources (bandwidth, CPU, storage).Self-organization of the systemAutonomy from central entities like central serversPeers come and go continuously changing environment
Very popular due to file-sharing and content distribution networks that today are responsible for majority of the traffic of the Internet
Network Security, WS 2008/09, Chapter 9 27Peer-to-Peer Systems and Security, SS 2009 27
Security
… but …Highly decentralized systems are not very secure.What about peers that do not cooperate?What about attacks or misuse?
… still….Peer-to-Peer systems are useful for censor-resistance, DoS resilience, etc.
Security is an important issue especially for serious applications. Decentralized systems have their drawbacks, but also a high potential for improvements!
Network Security, WS 2008/09, Chapter 9 28Peer-to-Peer Systems and Security, SS 2009 28
Anonymity & Privacy
In our daily life we are often an anonymous entity among a mass of other entities.
Pseudonymity: An entity hides behind a pseudonym, so that anyone (but an authority) only knows the pseudonym, but not the true identity. The pseudonym can be tracked.Anonymity: Hide the identity, the usage/traffic patterns, and relationships from other entities or observers. No tracking.
Traffic Analysis can reveal information that is leaked even if encryption is used. Technologies likeOnion Routing can make these attacks harder.
Network Security, WS 2008/09, Chapter 9 29Peer-to-Peer Systems and Security, SS 2009 29
Where are we?
Layer 7Layer 7
Layer 4Layer 4
Layer 3Layer 3
Layer 2Layer 2
Layer 1Layer 1
Layer 7Layer 7
Layer 4Layer 4
Layer 3Layer 3
Layer 2Layer 2
Layer 1Layer 1
Layer 3Layer 3
Layer 2Layer 2
Layer 1Layer 1
Layer 3Layer 3
Layer 2Layer 2
Layer 1Layer 1
Application Layer (e.g. HTTP)
Transport Layer (e.g. TCP, UDP)
Data Link Layer
Physical Layer
Network Layer(e.g. IP)
Data Link Layer
Physical Layer
… on the network stack...
Peer Peer
Network Layer(e.g. IP)
… on application layer with some exceptions.
Network Security, WS 2008/09, Chapter 9 30Peer-to-Peer Systems and Security, SS 2009 30
Where are we? II
Who is contributing / doing the work?
End system(Peer)
End system(Peer)
Network
End system(Peer)
End system(Peer)
End system(Peer)
End system(Peer)
End system(Peer)
![Hinweis - AWINSN 15:07 NSN 15:15 NSN 21-06 NSN 21:11 NSN 21:18 NSN 21:29 NSN 03:19 NSN 03:23 . 0 0 0 moom mooCMmT-iTÑl CS] CS] 0 CM Co w o? 0 m CM m CM I 0 U") ¥ 0 00 N W 0](https://static.fdokument.com/doc/165x107/60ae9e5ff18aba7fd01f75f9/hinweis-awi-nsn-1507-nsn-1515-nsn-21-06-nsn-2111-nsn-2118-nsn-2129-nsn-0319.jpg)
